QR Code Generator

Generate QR codes from text, URLs, WiFi credentials, vCards, or any data. Use when the user wants to create a QR code, share a link as a scannable code, gene...

This skill appears to do exactly what it claims (generate QR codes) and includes a small Python script. Before using: (1) be aware the script will run pip install qrcode[pil] if the package is missing — this performs network downloads and installs into your Python environment (run it in a virtualenv if you prefer isolation); (2) inspect/verify the qrcode package on PyPI if you have supply-chain concerns; (3) remember any WiFi password or contact info you encode will be visible to anyone who scans or sees the generated image; and (4) the script will overwrite files at the given output path, so avoid paths you can't afford to replace.

Type: OpenClaw Skill Name: qr-gen Version: 1.1.0 The `scripts/generate_qr.py` file contains two significant vulnerabilities. Firstly, it uses `subprocess.check_call` to install dependencies, which, while hardcoded to a legitimate package here, represents a powerful primitive that could lead to Remote Code Execution if the arguments were ever derived from untrusted input. Secondly, the script allows writing to arbitrary file paths via the `-o` argument without proper sanitization, creating a path traversal/arbitrary file write vulnerability. There is no clear evidence of intentional malicious behavior such as data exfiltration or backdoor installation, but these are serious flaws that could be exploited.